Debian patches Trapperkeeper flaw that exposed Puppet host catalogues
VULNERABILITYredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Debian advisory DSA-6609-1 fixes the trapperkeeper-authorization-clojure package. Incorrect validation of hostname ACLs in the Trapperkeeper authorisation service allows a Puppet client to retrieve the catalogue of a different host, which is an authorisation bypass with information disclosure impact. The article gives no CVE ID or affected version numbers. Defenders running Trapperkeeper-based Puppet servers on Debian should apply the DSA-6609-1 update and review logs for catalogue requests from clients to hosts other than their own.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Apply the Debian security update DSA-6609-1 to the trapperkeeper-authorization-clojure package.
- Check whether your Puppet servers run Trapperkeeper with this package installed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Debian Security Advisories